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AMENDMENTS TO THE CLAIMS 

Claim 1 (Currently Amended) A method for detecting abnormal traffic at the-a 
network level using a statistical analysis, the method comprising the steps of: 

a) gathering local traffic data from each network device and integrating a plurality of the 
local traffic data to generate traffic data in a-the network level by a single traffic sensing module ; 

b) extracting a characteristic traffic data based on the traffic data in the network level; 

c) comparing the characteristic traffic data with a characteristic traffic data profile 
resulting from statistical computations, and determining whether there is abnormal traffic in the 
network; and 

d) updating the characteristic traffic data profile using the characteristic traffic data if 
there is no abnormal traffic in the network, analyzing se riou s n es s a volume amount of the 
abnormal traffic and monitoring the abnormal traffic if there is abnormal traffic in the network. 

Claim 2 (Original) The method as recited in claim 1 , wherein the characteristic traffic 
data includes: 

information on traffic assigned to an application port which is selected according to an 
application service; 

information on traffic of which packet size is identical; and 

information on traffic of which the number of source-destination pairs, which represents 
the number of source addresses of the traffic having the same target address. 

Claim 3 (Original) The method as recited in claim 1 , further comprising the step of e) 
transmitting the analysis result of the seriousness of the abnormal traffic to an abnormal traffic 
processing system. 

Claim 4 (Currently Amended) A computer-readable recording medium for storing 
a program that implements a method for detecting abnormal traffic at the-a_network level using a 
statistical analysis, the method comprising the steps of: 
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a) gathering local traffic data from each network device and integrating a plurality of the 
local traffic data to generate traffic data in a -the network level by a single traffic sensing module ; 

b) extracting a characteristic traffic data based on the traffic data in the network level; 

c) comparing the characteristic traffic data with a characteristic traffic data profile 
resulting from statistical computations, and determining whether there is abnormal traffic in the 
network; and 

d) updating the characteristic traffic data profile using the characteristic traffic data if 
there is no abnormal traffic in the network, analyzing s e riousn e ss a volume amount of the 
abnormal traffic and monitoring the abnormal traffic if there is abnormal traffic in the network. 



